Categories
IETF

A response to draft-malas-dispatch-sip-egress-route-00

On 09.03.2010 18:27, Dean Willis wrote on the IETF dispatch list:

I definitely see the need for defining a method by which to inform nodes inside an ITAD of egress routes from that ITAD to other domains. I think that most of the people who have responded on this thread agree that there is such a need.

Yes, there is.

Where we have a disagreement is on mechanism. While your proposed use of ITAD-specific private ENUM servers is not completely inconsistent with recent trends in ENUM, I have to say we’ve done a lot of things in ENUM that I don’t like, and this is pushing the envelope further in that direction.

As I see the problem space, we’re conflating two independent problems:

a) how is routing-information exchanged between SSPs?

Here we have one approach which favors registries which digest routing-information and spit out suitable database dumps for provisioning the SSPs boxes. The other approach is to get some real routing-protocol up and running between SSPs (like BGP4 for IP layer 3 routing).

b) how is this routing-information conferred to the proxies/SBCs/… which do the actual SIP message processing / forwarding?

Now, if these proxies are actually participating in a dynamic routing protocol (or receive full dumps from a routing registry), then b) is internal to the proxy. Just as there is no protocol for moving routes from the BGP table of a router to the actual packet forwarding engine, this is purely internal to the box.

If, on the other hand, some entity distinct from the actual SIP devices handles the routing information (either by talking to a registry, or by running a dynamic routing protocol), then the SIP device needs a protocol to query that routing-oracle on what to do with a given call.

It seems to me that this is what ENUM is increasingly used for within SSPs.

IMHO this is the wrong protocol choice for this task.

Why?

* ENUM is a very simple DNS application. The only key to the lookup is the destination number, the only return value is an URL. (more or less)

* If you look at a good number of recent drafts you notice that people feel that this is not enough: they need “ID of the SIP device” or “caller-ID” in the query, and a sh*tload of URI-parameters (trunk-id, …) in the answer. See draft-mayrhofer-drinks-sed-elements for further data that might need to get stuffed into an ENUM response.

ENUM was never intended as call-control protocol where a proxy outsources its complete routing intelligence to an external party. It’s a simple key->URI directory lookup. The LRF (RFC 3263) and the intelligence was supposed to be within the SIP proxy.

Now, what we need here is something closer to RADIUS than to ENUM: a protocol where the SIP device can pack up all the information it has about the SIP INVITE into one request to the routing-oracle which then answers with a details set of parameters (the SED) on what the stupid proxy is
supposed to do now.

Trying to expand ENUM into doing just that is bound to fail.

Categories
Tracks

Tracks

A Sunday afternoon with the kids: Time to make room on the floor and build a nice set of tracks.

Categories
Internet

Random Link collection

I’ve kept these pages open as tabs in Firefox, meaning to blog about them.

So before I really have to reset Firefox, here are they lest I forget about them:

Categories
Tracks

Tracks

Categories
Tracks

Tracks

This one was built without much consideration based on a simple loop Clemens started. Looking at the finished layout I noticed that this one differs from the recent ones in one respect: there are no terminal loops in this one. There is no way the train can turn around.

Categories
Life

I can’t compete with Calvin

When we came back from a shopping trip tonight, the higher temperatures made the snow suitable for building. We made something conservative:

Categories
Tracks

Tracks

One of Clemens’ birthday present was an addition to the tracks (pieces + a train) by IKEA.

The tracks fit in nicely, but the bridge is too low: our normal trains cannot pass underneath.

Categories
Life

And now he’s 3.

We’ve come a long way since Jan 21th, 2007:

Categories
Internet

Mail an den ORF Kundendienst

Hallo,

heute hab ich mal versucht, die Entscheidung des Riesentorlaufes via Livestream auf ORF.at anzusehen, aber bekam die “geht nur in Österreich”-Fehlermeldung.

Ich bin in Österreich, und auch mein Netz ist eindeutig auf Österreich registriert:

inet6num: 2001:858:5:900::/56
netname: SIL-LENDL
descr: SILVER SERVER GmbH
descr: Otmar Lendl #1219171
country: AT

bzw

inet6num: 2001:858::/32
netname: AT-SIL-20020725
descr: SILVER SERVER GmbH
country: AT

Ist halt IPv6 und nicht das klassische IPv4.

Kann es sein, dass dort die Ländererkennung nicht richtig funktioniert?

Wenn ich bei mir v6 abdrehe und via v4 komme, dann geht der livestream auch problemlos.

mfg,

otmar lendl

Update: jetzt bekam ich eine Antwort vom ORF:

Sehr geehrter Herr Lendl!

Ich bedanke mich für Ihre E-Mail und Ihr Interesse an unserem Programm. Manchmal kann es vorkommen, dass Sie obige Meldung angezeigt bekommen, obwohl sie sich in Österreich befinden. Dieser Fehler passiert vor allem bei international tätigen Internetprovidern, deren Firmensitze sich im Ausland befinden. Wenn der Server ihre IP-Adresse nicht als österreichisch erkennt, müssen Sie ihren ISP (Internet Service Provider) kontaktieren.

Auf folgenden Internetseiten können Sie herausfinden, welchem Land ihre IP-Adresse zugeordnet ist.

http://www.wieistmeineip.at
http://www.countryipblocks.net

Sollte sich das von Ihnen beschriebene Problem damit nicht erklären lassen, so geben Sie bitte Bescheid, ich leite Ihre Anfrage dann gerne an die Technik weiter.

Ich verbleibe mit freundlichen Grüßen
Stefanie Steinwender

Seufz.

Update 2 (17.2.2010):

Innerhalb des ORF wurde das entsprechend weitergeleitet und auch prompt gefixt. Wirklich verifizieren konnte ich das aber erst jetzt: Vor Olympia war einfach fast kein Skifahren im Fernsehen.

Categories
CERT Internet

MasterCard SecureCode: Just say no.

Sometime the timing is just too perfect.

Yesterday I was trying to book a flight on Brussel Airlines and when I was trying to pay via credit card, they insisted on an on-the-fly enrollment to MasterCard SecureCode. I refused and booked via the AMEX Business Service.

Today a security analysis of the whole scheme was published by British scientists, confirming my reservations.

Money quotes:

“Merchants who use it push liability for fraud back to banks, who in turn push it on to cardholders.”

“So this is yet another case where security economics trumps security engineering, but in a predatory way that leaves cardholders less secure.”